The Privacy Protection Authority ('PPA') announced, via LinkedIn, on 3 April 2023, that the Ministerial Committee on Legislation has approved the application of the rule of continuity for the advancement of the Privacy Protection Bill (Amendment No. 14), 5722-2022 ('Amendment 14'), amending the Protection of Privacy Law, 5741-1981 ('PPL'), after its progress had been stalled due to the dissolution of the Israeli Parliament ('Knesset'). In particular, the PPA stated that Amendment 14 was approved in the first reading by the Knesset in January 2022, and shall now move to the second and third readings of the same.

Notably, the PPA highlighted that Amendment 14 provides for an expansion of the PPA's enforcement powers, setting financial sanctions for violating the provisions of the PPL and its regulations, updating all offenses in relation to databases, and substantive definitions in the PPL, as well as significantly reducing the obligation to register databases.

You can read the post here, read Amendment 14 here, and track the progress of Amendment 14 here, all only available in Hebrew.

UPDATE: 19 December 2023

Constitution, Law, and Justice Committee prepares Amendment 14 for second and third reading 

The Knesset announced, on 4 December 2023, that the Constitution, Law, and Justice Committee is preparing Amendment 14 for the second and third reading and subsequently had further discussions in the Committee on 11 December 2023, and 18 December 2023.

You can read Amendment 14 here and track its progress here, both only available in Hebrew.

UPDATE: 19 July 2024

Constitution, Law, and Justice Committee concludes discussion on Amendment 14

On 18 July 2024, OneTrust DataGuidance Research confirmed with Dalit Ben Israel, Partner at Naschitz Brandes Amir, that the Constitution, Law, and Justice Committee discussion on the regulatory changes in Amendment 14 was finalized on 14 July 2024. 

According to Dalit ''the vote at the Constitutional, Law, and Justice Committee is set for Sunday, 21 July 2024, and the next step is the final adoption at the main plenary of the Parliament. Amendment 14 will enter into force 12 months from its publication.''

What are the key changes?

Dalit highlighted the key changes of Amendment 14, including:

• ''new definitions of controller, processor, personal data, especially sensitive data and processing (similar to the General Data Protection Regulation (GDPR));
• database manager requirement - removed and new mandatory data protection officer (DPO) appointment - included, and changes in the appointment of an information security officer;
• database registration - removed (except public entities and data brokers), new notification obligation for databases of especially sensitive data of 100,000 data subjects - included;
• new purpose limitation principle - prohibition on processing personal data for a purpose contrary to the lawfully compliant purposes set for such database;
• extensive investigative and enforcement powers added for the Privacy Protection Authority (PPA);
• new substantial administrative fines (amounting to millions of NIS if multiple obligations are breached), some imposed without prior opportunity to remedy;
• court order to stop processing, when certain material provisions are breached;
• amendment of the list of criminal offenses;
• new statutory damages in civil claims (NIS 10,000 (approx. $2,735))
• limitation period aligned to seven years of the general law;
• new statutory pre-ruling procedure; and
• specific provisions for law enforcement agencies.''

Dalit further added that Amendment 14 ''is a significant milestone for Israeli privacy, to be followed (hopefully soon) by Bill 15 to complete this legislative journey (covering legal bases, data subject rights, and more).''

You can read Amendment 14 as presented for the first reading here and track its progress here, both only available in Hebrew.

UPDATE: 19 July 2024

Amendment 14 passes Constitution, Law, and Justice Committee

On 22 July 2024, OneTrust DataGuidance Research confirmed with Dalit Ben Israel, Partner at Naschitz Brandes Amir, that the Constitution, Law, and Justice Committee approved, by a vote, Amendment 14, on 21 July 2024. 

Next steps

Dalit added that ''Amendment 14 will be re-numbered as 13 and is currently scheduled for a final vote at the Parliament (Knesset) on Wednesday assuming that the legal counsel of the Knesset completes the final drafting.''

You can read Amendment 14 as presented for the first reading here track its progress here, and view the weekly Knesset schedule here, all only available in Hebrew.

UPDATE: 8 August 2024

PPL amendment bill passes Knesset

On 8 August 2024, the PPA announced that the Knesset passed Amendment 14, now renamed as Amendment No. 13 into law. 

What are the notable provisions of Amendment No. 13?

According to the PPA, Amendment No. 13 amends the Protection of Privacy Law (PPL), establishes new and advanced arrangements, and provides effective enforcement tools, in a way that will match the challenges of the digital age, will increase the protection of the Israeli public's fundamental right to privacy and strengthen the fight against the growing cyber threats. The amendment updates and clarifies all the essential definitions in the PPL and includes data that would be considered as 'specially sensitive information.' Amendment No. 13 also expands the authority to award compensation without proof of damage. The following are the notable amendments to PPL, among others. 

PPA 

The PPA's authority to impose financial sanctions for violating the provisions of the law and regulations in the field of information security, in significant amounts, is incorporated. PPA's administrative enforcement powers were regulated, and the criminal investigation powers of the PPA's investigators were anchored in Amendment No. 13. Additionally, the PPA's authority to act to obtain a judicial order for the cessation of processing of personal information, including its deletion, in cases where this is required to stop a violation of the provisions of the law, is included.

Privacy protection officer

Amendment No. 13 introduces the obligation to appoint a privacy protection officer in public bodies and in any organization whose main occupation includes the processing of sensitive personal information to a considerable extent, as well as in any organization whose activity involves the systematic monitoring or tracking of people to a considerable extent. The role of the privacy protection officer in the organization is to act to ensure compliance with the provisions of the PPL and its regulations and to promote the protection of privacy even beyond the requirements of the law.

Additionally, Amendment No. 13 includes the obligation to appoint an internal privacy inspector in all security agencies. The internal inspector will be guided by the PPA and will supervise the procedures of the security body and its policy in the field of privacy protection, identify violations of the PPL, hold training on privacy issues, and submit reports to the head of the PPA.

Database registration

Amendment No. 13 reduces the regulatory burden through a significant reduction of the obligation to register digital databases. As part of the amendments, the obligation applicable to entities in the private sector to register the databases under their management will be almost completely abolished, with the exception of databases managed by those engaged in information trade (in relation to public entities, the obligation will be waived). At the same time, an arrangement was established according to which the PPA can be requested for a preliminary opinion regarding compliance with the requirements of the law or the regulations.

Ban on the processing of illegally collected personal information and criminal offenses 

Amendment No. 13 has a dedicated chapter on criminal offenses in databases, which includes, among other things, processing information without the permission of the person controlling the database, and deliberately misleading a person when contacting them to request personal information. Amendment No. 13 also includes a blanket prohibition on performing any action with personal information collected illegally.

Next steps

Amendment No. 13 will become effective one year from the date of its publication. 

Notwithstanding the above, the commencement of the section applicable to the powers of supervision and administrative investigation of the inspectors of the PPA to the Israel Police databases will be three years from the date of commencement. The Judiciary, with the consent of the Minister of National Security and the approval of the Constitution, Law, and Justice Committee of the Knesset, may postpone the aforementioned date by three years, each time.

You can read the press release here and Amendment No.13 here, both only available in Hebrew.